Merge remote-tracking branch 'remotes/source/dev' into deploy_nuster
# Conflicts: # deploy/README.mdpull/2171/head
CantonBolo
6 years ago
commit
56818c9ad2
@ -0,0 +1,140 @@
|
||||
#!/usr/bin/env sh
|
||||
|
||||
# Here is the script to deploy the cert to G-Core CDN service (https://gcorelabs.com/ru/) using the G-Core Labs API (https://docs.gcorelabs.com/cdn/).
|
||||
# Uses command line curl for send requests and jq for parse responses.
|
||||
# Returns 0 when success.
|
||||
#
|
||||
# Written by temoffey <temofffey@gmail.com>
|
||||
# Public domain, 2019
|
||||
|
||||
#export DEPLOY_GCORE_CDN_USERNAME=myusername
|
||||
#export DEPLOY_GCORE_CDN_PASSWORD=mypassword
|
||||
|
||||
######## Public functions #####################
|
||||
|
||||
#domain keyfile certfile cafile fullchain
|
||||
|
||||
gcore_cdn_deploy() {
|
||||
_cdomain="$1"
|
||||
_ckey="$2"
|
||||
_ccert="$3"
|
||||
_cca="$4"
|
||||
_cfullchain="$5"
|
||||
|
||||
_debug _cdomain "$_cdomain"
|
||||
_debug _ckey "$_ckey"
|
||||
_debug _ccert "$_ccert"
|
||||
_debug _cca "$_cca"
|
||||
_debug _cfullchain "$_cfullchain"
|
||||
|
||||
_fullchain=$(tr '\n\r' '@#' <"$_cfullchain" | sed 's/@/\\n/g;s/#/\\r/g')
|
||||
_key=$(tr '\n\r' '@#' <"$_ckey" | sed 's/@/\\n/g;s/#/\\r/g')
|
||||
|
||||
_debug _fullchain "$_fullchain"
|
||||
_debug _key "$_key"
|
||||
|
||||
if [ -z "$DEPLOY_GCORE_CDN_USERNAME" ]; then
|
||||
if [ -z "$Le_Deploy_gcore_cdn_username" ]; then
|
||||
_err "Please define the target username: export DEPLOY_GCORE_CDN_USERNAME=username"
|
||||
return 1
|
||||
fi
|
||||
else
|
||||
Le_Deploy_gcore_cdn_username="$DEPLOY_GCORE_CDN_USERNAME"
|
||||
_savedomainconf Le_Deploy_gcore_cdn_username "$Le_Deploy_gcore_cdn_username"
|
||||
fi
|
||||
|
||||
if [ -z "$DEPLOY_GCORE_CDN_PASSWORD" ]; then
|
||||
if [ -z "$Le_Deploy_gcore_cdn_password" ]; then
|
||||
_err "Please define the target password: export DEPLOY_GCORE_CDN_PASSWORD=password"
|
||||
return 1
|
||||
fi
|
||||
else
|
||||
Le_Deploy_gcore_cdn_password="$DEPLOY_GCORE_CDN_PASSWORD"
|
||||
_savedomainconf Le_Deploy_gcore_cdn_password "$Le_Deploy_gcore_cdn_password"
|
||||
fi
|
||||
|
||||
_info "Get authorization token"
|
||||
_request="{\"username\":\"$Le_Deploy_gcore_cdn_username\",\"password\":\"$Le_Deploy_gcore_cdn_password\"}"
|
||||
_debug _request "$_request"
|
||||
export _H1="Content-Type:application/json"
|
||||
_response=$(_post "$_request" "https://api.gcdn.co/auth/signin")
|
||||
_debug _response "$_response"
|
||||
_regex=".*\"token\":\"\([-._0-9A-Za-z]*\)\".*$"
|
||||
_debug _regex "$_regex"
|
||||
_token=$(echo "$_response" | sed -n "s/$_regex/\1/p")
|
||||
_debug _token "$_token"
|
||||
|
||||
if [ -z "$_token" ]; then
|
||||
_err "Error G-Core Labs API authorization"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_info "Find CDN resource with cname $_cdomain"
|
||||
export _H2="Authorization:Token $_token"
|
||||
_response=$(_get "https://api.gcdn.co/resources")
|
||||
_debug _response "$_response"
|
||||
_regex=".*(\"id\".*?\"cname\":\"$_cdomain\".*?})"
|
||||
_regex="^.*\"cname\":\"$_cdomain\".*$"
|
||||
_debug _regex "$_regex"
|
||||
_resource=$(echo "$_response" | sed 's/},{/},\n{/g' | _egrep_o "$_regex")
|
||||
_debug _resource "$_resource"
|
||||
_regex=".*\"id\":\([0-9]*\),.*$"
|
||||
_debug _regex "$_regex"
|
||||
_resourceId=$(echo "$_resource" | sed -n "s/$_regex/\1/p")
|
||||
_debug _resourceId "$_resourceId"
|
||||
_regex=".*\"sslData\":\([0-9]*\)}.*$"
|
||||
_debug _regex "$_regex"
|
||||
_sslDataOld=$(echo "$_resource" | sed -n "s/$_regex/\1/p")
|
||||
_debug _sslDataOld "$_sslDataOld"
|
||||
_regex=".*\"originGroup\":\([0-9]*\),.*$"
|
||||
_debug _regex "$_regex"
|
||||
_originGroup=$(echo "$_resource" | sed -n "s/$_regex/\1/p")
|
||||
_debug _originGroup "$_originGroup"
|
||||
|
||||
if [ -z "$_resourceId" ] || [ -z "$_originGroup" ]; then
|
||||
_err "Not found CDN resource with cname $_cdomain"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_info "Add new SSL certificate"
|
||||
_date=$(date "+%d.%m.%Y %H:%M:%S")
|
||||
_request="{\"name\":\"$_cdomain ($_date)\",\"sslCertificate\":\"$_fullchain\",\"sslPrivateKey\":\"$_key\"}"
|
||||
_debug _request "$_request"
|
||||
_response=$(_post "$_request" "https://api.gcdn.co/sslData")
|
||||
_debug _response "$_response"
|
||||
_regex=".*\"id\":\([0-9]*\),.*$"
|
||||
_debug _regex "$_regex"
|
||||
_sslDataAdd=$(echo "$_response" | sed -n "s/$_regex/\1/p")
|
||||
_debug _sslDataAdd "$_sslDataAdd"
|
||||
|
||||
if [ -z "$_sslDataAdd" ]; then
|
||||
_err "Error new SSL certificate add"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_info "Update CDN resource"
|
||||
_request="{\"originGroup\":$_originGroup,\"sslData\":$_sslDataAdd}"
|
||||
_debug _request "$_request"
|
||||
_response=$(_post "$_request" "https://api.gcdn.co/resources/$_resourceId" '' "PUT")
|
||||
_debug _response "$_response"
|
||||
_regex=".*\"sslData\":\([0-9]*\)}.*$"
|
||||
_debug _regex "$_regex"
|
||||
_sslDataNew=$(echo "$_response" | sed -n "s/$_regex/\1/p")
|
||||
_debug _sslDataNew "$_sslDataNew"
|
||||
|
||||
if [ "$_sslDataNew" != "$_sslDataAdd" ]; then
|
||||
_err "Error CDN resource update"
|
||||
return 1
|
||||
fi
|
||||
|
||||
if [ -z "$_sslDataOld" ] || [ "$_sslDataOld" = "null" ]; then
|
||||
_info "Not found old SSL certificate"
|
||||
else
|
||||
_info "Delete old SSL certificate"
|
||||
_response=$(_post '' "https://api.gcdn.co/sslData/$_sslDataOld" '' "DELETE")
|
||||
_debug _response "$_response"
|
||||
fi
|
||||
|
||||
_info "Certificate successfully deployed"
|
||||
return 0
|
||||
}
|
||||
@ -0,0 +1,58 @@
|
||||
#!/usr/bin/env sh
|
||||
|
||||
#Here is a script to deploy cert to mailcow.
|
||||
|
||||
#returns 0 means success, otherwise error.
|
||||
|
||||
######## Public functions #####################
|
||||
|
||||
#domain keyfile certfile cafile fullchain
|
||||
mailcow_deploy() {
|
||||
_cdomain="$1"
|
||||
_ckey="$2"
|
||||
_ccert="$3"
|
||||
_cca="$4"
|
||||
_cfullchain="$5"
|
||||
|
||||
_debug _cdomain "$_cdomain"
|
||||
_debug _ckey "$_ckey"
|
||||
_debug _ccert "$_ccert"
|
||||
_debug _cca "$_cca"
|
||||
_debug _cfullchain "$_cfullchain"
|
||||
|
||||
_mailcow_path="${DEPLOY_MAILCOW_PATH}"
|
||||
|
||||
if [ -z "$_mailcow_path" ]; then
|
||||
_err "Mailcow path is not found, please define DEPLOY_MAILCOW_PATH."
|
||||
return 1
|
||||
fi
|
||||
|
||||
_ssl_path="${_mailcow_path}/data/assets/ssl/"
|
||||
if [ ! -d "$_ssl_path" ]; then
|
||||
_err "Cannot find mailcow ssl path: $_ssl_path"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_info "Copying key and cert"
|
||||
_real_key="$_ssl_path/key.pem"
|
||||
if ! cat "$_ckey" >"$_real_key"; then
|
||||
_err "Error: write key file to: $_real_key"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_real_fullchain="$_ssl_path/cert.pem"
|
||||
if ! cat "$_cfullchain" >"$_real_fullchain"; then
|
||||
_err "Error: write cert file to: $_real_fullchain"
|
||||
return 1
|
||||
fi
|
||||
|
||||
DEFAULT_MAILCOW_RELOAD="cd ${_mailcow_path} && docker-compose restart postfix-mailcow dovecot-mailcow nginx-mailcow"
|
||||
_reload="${DEPLOY_MAILCOW_RELOAD:-$DEFAULT_MAILCOW_RELOAD}"
|
||||
|
||||
_info "Run reload: $_reload"
|
||||
if eval "$_reload"; then
|
||||
_info "Reload success!"
|
||||
fi
|
||||
return 0
|
||||
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,204 @@
|
||||
#!/usr/bin/env sh
|
||||
#
|
||||
# deSEC.io Domain API
|
||||
#
|
||||
# Author: Zheng Qian
|
||||
#
|
||||
# deSEC API doc
|
||||
# https://desec.readthedocs.io/en/latest/
|
||||
|
||||
REST_API="https://desec.io/api/v1/domains"
|
||||
|
||||
######## Public functions #####################
|
||||
|
||||
#Usage: dns_desec_add _acme-challenge.foobar.dedyn.io "d41d8cd98f00b204e9800998ecf8427e"
|
||||
dns_desec_add() {
|
||||
fulldomain=$1
|
||||
txtvalue=$2
|
||||
_info "Using desec.io api"
|
||||
_debug fulldomain "$fulldomain"
|
||||
_debug txtvalue "$txtvalue"
|
||||
|
||||
DEDYN_TOKEN="${DEDYN_TOKEN:-$(_readaccountconf_mutable DEDYN_TOKEN)}"
|
||||
DEDYN_NAME="${DEDYN_NAME:-$(_readaccountconf_mutable DEDYN_NAME)}"
|
||||
|
||||
if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
|
||||
DEDYN_TOKEN=""
|
||||
DEDYN_NAME=""
|
||||
_err "You don't specify DEDYN_TOKEN and DEDYN_NAME yet."
|
||||
_err "Please create you key and try again."
|
||||
_err "e.g."
|
||||
_err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
|
||||
_err "export DEDYN_NAME=foobar.dedyn.io"
|
||||
return 1
|
||||
fi
|
||||
#save the api token and name to the account conf file.
|
||||
_saveaccountconf_mutable DEDYN_TOKEN "$DEDYN_TOKEN"
|
||||
_saveaccountconf_mutable DEDYN_NAME "$DEDYN_NAME"
|
||||
|
||||
_debug "First detect the root zone"
|
||||
if ! _get_root "$fulldomain" "$REST_API/"; then
|
||||
_err "invalid domain"
|
||||
return 1
|
||||
fi
|
||||
_debug _sub_domain "$_sub_domain"
|
||||
_debug _domain "$_domain"
|
||||
|
||||
# Get existing TXT record
|
||||
_debug "Getting txt records"
|
||||
txtvalues="\"\\\"$txtvalue\\\"\""
|
||||
_desec_rest GET "$REST_API/$DEDYN_NAME/rrsets/$_sub_domain/TXT/"
|
||||
|
||||
if [ "$_code" = "200" ]; then
|
||||
oldtxtvalues="$(echo "$response" | _egrep_o "\"records\":\\[\"\\S*\"\\]" | cut -d : -f 2 | tr -d "[]\\\\\"" | sed "s/,/ /g")"
|
||||
_debug "existing TXT found"
|
||||
_debug oldtxtvalues "$oldtxtvalues"
|
||||
if [ -n "$oldtxtvalues" ]; then
|
||||
for oldtxtvalue in $oldtxtvalues; do
|
||||
txtvalues="$txtvalues, \"\\\"$oldtxtvalue\\\"\""
|
||||
done
|
||||
fi
|
||||
fi
|
||||
_debug txtvalues "$txtvalues"
|
||||
_info "Adding record"
|
||||
body="[{\"subname\":\"$_sub_domain\", \"type\":\"TXT\", \"records\":[$txtvalues], \"ttl\":60}]"
|
||||
|
||||
if _desec_rest PUT "$REST_API/$DEDYN_NAME/rrsets/" "$body"; then
|
||||
if _contains "$response" "$txtvalue"; then
|
||||
_info "Added, OK"
|
||||
return 0
|
||||
else
|
||||
_err "Add txt record error."
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
_err "Add txt record error."
|
||||
return 1
|
||||
}
|
||||
|
||||
#Usage: fulldomain txtvalue
|
||||
#Remove the txt record after validation.
|
||||
dns_desec_rm() {
|
||||
fulldomain=$1
|
||||
txtvalue=$2
|
||||
_info "Using desec.io api"
|
||||
_debug fulldomain "$fulldomain"
|
||||
_debug txtvalue "$txtvalue"
|
||||
|
||||
DEDYN_TOKEN="${DEDYN_TOKEN:-$(_readaccountconf_mutable DEDYN_TOKEN)}"
|
||||
DEDYN_NAME="${DEDYN_NAME:-$(_readaccountconf_mutable DEDYN_NAME)}"
|
||||
|
||||
if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
|
||||
DEDYN_TOKEN=""
|
||||
DEDYN_NAME=""
|
||||
_err "You don't specify DEDYN_TOKEN and DEDYN_NAME yet."
|
||||
_err "Please create you key and try again."
|
||||
_err "e.g."
|
||||
_err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
|
||||
_err "export DEDYN_NAME=foobar.dedyn.io"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_debug "First detect the root zone"
|
||||
if ! _get_root "$fulldomain" "$REST_API/"; then
|
||||
_err "invalid domain"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_debug _sub_domain "$_sub_domain"
|
||||
_debug _domain "$_domain"
|
||||
|
||||
# Get existing TXT record
|
||||
_debug "Getting txt records"
|
||||
txtvalues=""
|
||||
_desec_rest GET "$REST_API/$DEDYN_NAME/rrsets/$_sub_domain/TXT/"
|
||||
|
||||
if [ "$_code" = "200" ]; then
|
||||
oldtxtvalues="$(echo "$response" | _egrep_o "\"records\":\\[\"\\S*\"\\]" | cut -d : -f 2 | tr -d "[]\\\\\"" | sed "s/,/ /g")"
|
||||
_debug "existing TXT found"
|
||||
_debug oldtxtvalues "$oldtxtvalues"
|
||||
if [ -n "$oldtxtvalues" ]; then
|
||||
for oldtxtvalue in $oldtxtvalues; do
|
||||
if [ "$txtvalue" != "$oldtxtvalue" ]; then
|
||||
txtvalues="$txtvalues, \"\\\"$oldtxtvalue\\\"\""
|
||||
fi
|
||||
done
|
||||
fi
|
||||
fi
|
||||
txtvalues="$(echo "$txtvalues" | cut -c3-)"
|
||||
_debug txtvalues "$txtvalues"
|
||||
|
||||
_info "Deleting record"
|
||||
body="[{\"subname\":\"$_sub_domain\", \"type\":\"TXT\", \"records\":[$txtvalues], \"ttl\":60}]"
|
||||
_desec_rest PUT "$REST_API/$DEDYN_NAME/rrsets/" "$body"
|
||||
if [ "$_code" = "200" ]; then
|
||||
_info "Deleted, OK"
|
||||
return 0
|
||||
fi
|
||||
|
||||
_err "Delete txt record error."
|
||||
return 1
|
||||
}
|
||||
|
||||
#################### Private functions below ##################################
|
||||
|
||||
_desec_rest() {
|
||||
m="$1"
|
||||
ep="$2"
|
||||
data="$3"
|
||||
|
||||
export _H1="Authorization: Token $DEDYN_TOKEN"
|
||||
export _H2="Accept: application/json"
|
||||
export _H3="Content-Type: application/json"
|
||||
|
||||
if [ "$m" != "GET" ]; then
|
||||
_secure_debug2 data "$data"
|
||||
response="$(_post "$data" "$ep" "" "$m")"
|
||||
else
|
||||
response="$(_get "$ep")"
|
||||
fi
|
||||
_ret="$?"
|
||||
_code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
|
||||
_debug "http response code $_code"
|
||||
_secure_debug2 response "$response"
|
||||
if [ "$_ret" != "0" ]; then
|
||||
_err "error $ep"
|
||||
return 1
|
||||
fi
|
||||
|
||||
response="$(printf "%s" "$response" | _normalizeJson)"
|
||||
return 0
|
||||
}
|
||||
|
||||
#_acme-challenge.www.domain.com
|
||||
#returns
|
||||
# _sub_domain=_acme-challenge.www
|
||||
# _domain=domain.com
|
||||
_get_root() {
|
||||
domain="$1"
|
||||
ep="$2"
|
||||
i=2
|
||||
p=1
|
||||
while true; do
|
||||
h=$(printf "%s" "$domain" | cut -d . -f $i-100)
|
||||
_debug h "$h"
|
||||
if [ -z "$h" ]; then
|
||||
#not valid
|
||||
return 1
|
||||
fi
|
||||
|
||||
if ! _desec_rest GET "$ep"; then
|
||||
return 1
|
||||
fi
|
||||
|
||||
if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
|
||||
_sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
|
||||
_domain=$h
|
||||
return 0
|
||||
fi
|
||||
p=$i
|
||||
i=$(_math "$i" + 1)
|
||||
done
|
||||
return 1
|
||||
}
|
||||
@ -0,0 +1,244 @@
|
||||
#!/usr/bin/env sh
|
||||
|
||||
# This is the OpenProvider API wrapper for acme.sh
|
||||
#
|
||||
# Author: Sylvia van Os
|
||||
# Report Bugs here: https://github.com/Neilpang/acme.sh/issues/2104
|
||||
#
|
||||
# export OPENPROVIDER_USER="username"
|
||||
# export OPENPROVIDER_PASSWORDHASH="hashed_password"
|
||||
#
|
||||
# Usage:
|
||||
# acme.sh --issue --dns dns_openprovider -d example.com
|
||||
|
||||
OPENPROVIDER_API="https://api.openprovider.eu/"
|
||||
#OPENPROVIDER_API="https://api.cte.openprovider.eu/" # Test API
|
||||
|
||||
######## Public functions #####################
|
||||
|
||||
#Usage: dns_openprovider_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
|
||||
dns_openprovider_add() {
|
||||
fulldomain="$1"
|
||||
txtvalue="$2"
|
||||
|
||||
OPENPROVIDER_USER="${OPENPROVIDER_USER:-$(_readaccountconf_mutable OPENPROVIDER_USER)}"
|
||||
OPENPROVIDER_PASSWORDHASH="${OPENPROVIDER_PASSWORDHASH:-$(_readaccountconf_mutable OPENPROVIDER_PASSWORDHASH)}"
|
||||
|
||||
if [ -z "$OPENPROVIDER_USER" ] || [ -z "$OPENPROVIDER_PASSWORDHASH" ]; then
|
||||
_err "You didn't specify the openprovider user and/or password hash."
|
||||
return 1
|
||||
fi
|
||||
|
||||
# save the username and password to the account conf file.
|
||||
_saveaccountconf_mutable OPENPROVIDER_USER "$OPENPROVIDER_USER"
|
||||
_saveaccountconf_mutable OPENPROVIDER_PASSWORDHASH "$OPENPROVIDER_PASSWORDHASH"
|
||||
|
||||
_debug "First detect the root zone"
|
||||
if ! _get_root "$fulldomain"; then
|
||||
_err "invalid domain"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_debug _domain_name "$_domain_name"
|
||||
_debug _domain_extension "$_domain_extension"
|
||||
|
||||
_debug "Getting current records"
|
||||
existing_items=""
|
||||
results_retrieved=0
|
||||
while true; do
|
||||
_openprovider_request "$(printf '<searchZoneRecordDnsRequest><name>%s.%s</name><offset>%s</offset></searchZoneRecordDnsRequest>' "$_domain_name" "$_domain_extension" "$results_retrieved")"
|
||||
|
||||
items="$response"
|
||||
while true; do
|
||||
item="$(echo "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n 's/.*\(<item>.*<\/item>\).*/\1/p')"
|
||||
_debug existing_items "$existing_items"
|
||||
_debug results_retrieved "$results_retrieved"
|
||||
_debug item "$item"
|
||||
|
||||
if [ -z "$item" ]; then
|
||||
break
|
||||
fi
|
||||
|
||||
items="$(echo "$items" | sed "s|${item}||")"
|
||||
|
||||
results_retrieved="$(_math "$results_retrieved" + 1)"
|
||||
new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)\.'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
|
||||
if [ -z "$new_item" ]; then
|
||||
# Base record
|
||||
new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
|
||||
fi
|
||||
|
||||
if [ -z "$(echo "$new_item" | _egrep_o ".*<type>(A|AAAA|CNAME|MX|SPF|SRV|TXT|TLSA|SSHFP|CAA)<\/type>.*")" ]; then
|
||||
_debug "not an allowed record type, skipping" "$new_item"
|
||||
continue
|
||||
fi
|
||||
|
||||
existing_items="$existing_items$new_item"
|
||||
done
|
||||
|
||||
total="$(echo "$response" | _egrep_o '<total>.*?<\/total>' | sed -n 's/.*<total>\(.*\)<\/total>.*/\1/p')"
|
||||
|
||||
_debug total "$total"
|
||||
if [ "$results_retrieved" -eq "$total" ]; then
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
_debug "Creating acme record"
|
||||
acme_record="$(echo "$fulldomain" | sed -e "s/.$_domain_name.$_domain_extension$//")"
|
||||
_openprovider_request "$(printf '<modifyZoneDnsRequest><domain><name>%s</name><extension>%s</extension></domain><type>master</type><records><array>%s<item><name>%s</name><type>TXT</type><value>%s</value><ttl>86400</ttl></item></array></records></modifyZoneDnsRequest>' "$_domain_name" "$_domain_extension" "$existing_items" "$acme_record" "$txtvalue")"
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
#Usage: fulldomain txtvalue
|
||||
#Remove the txt record after validation.
|
||||
dns_openprovider_rm() {
|
||||
fulldomain="$1"
|
||||
txtvalue="$2"
|
||||
|
||||
OPENPROVIDER_USER="${OPENPROVIDER_USER:-$(_readaccountconf_mutable OPENPROVIDER_USER)}"
|
||||
OPENPROVIDER_PASSWORDHASH="${OPENPROVIDER_PASSWORDHASH:-$(_readaccountconf_mutable OPENPROVIDER_PASSWORDHASH)}"
|
||||
|
||||
if [ -z "$OPENPROVIDER_USER" ] || [ -z "$OPENPROVIDER_PASSWORDHASH" ]; then
|
||||
_err "You didn't specify the openprovider user and/or password hash."
|
||||
return 1
|
||||
fi
|
||||
|
||||
# save the username and password to the account conf file.
|
||||
_saveaccountconf_mutable OPENPROVIDER_USER "$OPENPROVIDER_USER"
|
||||
_saveaccountconf_mutable OPENPROVIDER_PASSWORDHASH "$OPENPROVIDER_PASSWORDHASH"
|
||||
|
||||
_debug "First detect the root zone"
|
||||
if ! _get_root "$fulldomain"; then
|
||||
_err "invalid domain"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_debug _domain_name "$_domain_name"
|
||||
_debug _domain_extension "$_domain_extension"
|
||||
|
||||
_debug "Getting current records"
|
||||
existing_items=""
|
||||
results_retrieved=0
|
||||
while true; do
|
||||
_openprovider_request "$(printf '<searchZoneRecordDnsRequest><name>%s.%s</name><offset>%s</offset></searchZoneRecordDnsRequest>' "$_domain_name" "$_domain_extension" "$results_retrieved")"
|
||||
|
||||
# Remove acme records from items
|
||||
items="$response"
|
||||
while true; do
|
||||
item="$(echo "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n 's/.*\(<item>.*<\/item>\).*/\1/p')"
|
||||
_debug existing_items "$existing_items"
|
||||
_debug results_retrieved "$results_retrieved"
|
||||
_debug item "$item"
|
||||
|
||||
if [ -z "$item" ]; then
|
||||
break
|
||||
fi
|
||||
|
||||
items="$(echo "$items" | sed "s|${item}||")"
|
||||
|
||||
results_retrieved="$(_math "$results_retrieved" + 1)"
|
||||
if ! echo "$item" | grep -v "$fulldomain"; then
|
||||
_debug "acme record, skipping" "$item"
|
||||
continue
|
||||
fi
|
||||
|
||||
new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)\.'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
|
||||
|
||||
if [ -z "$new_item" ]; then
|
||||
# Base record
|
||||
new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
|
||||
fi
|
||||
|
||||
if [ -z "$(echo "$new_item" | _egrep_o ".*<type>(A|AAAA|CNAME|MX|SPF|SRV|TXT|TLSA|SSHFP|CAA)<\/type>.*")" ]; then
|
||||
_debug "not an allowed record type, skipping" "$new_item"
|
||||
continue
|
||||
fi
|
||||
|
||||
existing_items="$existing_items$new_item"
|
||||
done
|
||||
|
||||
total="$(echo "$response" | _egrep_o '<total>.*?<\/total>' | sed -n 's/.*<total>\(.*\)<\/total>.*/\1/p')"
|
||||
|
||||
_debug total "$total"
|
||||
|
||||
if [ "$results_retrieved" -eq "$total" ]; then
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
_debug "Removing acme record"
|
||||
_openprovider_request "$(printf '<modifyZoneDnsRequest><domain><name>%s</name><extension>%s</extension></domain><type>master</type><records><array>%s</array></records></modifyZoneDnsRequest>' "$_domain_name" "$_domain_extension" "$existing_items")"
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
#################### Private functions below ##################################
|
||||
#_acme-challenge.www.domain.com
|
||||
#returns
|
||||
# _domain_name=domain
|
||||
# _domain_extension=com
|
||||
_get_root() {
|
||||
domain=$1
|
||||
i=2
|
||||
|
||||
results_retrieved=0
|
||||
while true; do
|
||||
h=$(echo "$domain" | cut -d . -f $i-100)
|
||||
_debug h "$h"
|
||||
if [ -z "$h" ]; then
|
||||
#not valid
|
||||
return 1
|
||||
fi
|
||||
|
||||
_openprovider_request "$(printf '<searchDomainRequest><domainNamePattern>%s</domainNamePattern><offset>%s</offset></searchDomainRequest>' "$(echo "$h" | cut -d . -f 1)" "$results_retrieved")"
|
||||
|
||||
items="$response"
|
||||
while true; do
|
||||
item="$(echo "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n 's/.*\(<domain>.*<\/domain>\).*/\1/p')"
|
||||
_debug existing_items "$existing_items"
|
||||
_debug results_retrieved "$results_retrieved"
|
||||
_debug item "$item"
|
||||
|
||||
if [ -z "$item" ]; then
|
||||
break
|
||||
fi
|
||||
|
||||
items="$(echo "$items" | sed "s|${item}||")"
|
||||
|
||||
results_retrieved="$(_math "$results_retrieved" + 1)"
|
||||
|
||||
_domain_name="$(echo "$item" | sed -n 's/.*<domain>.*<name>\(.*\)<\/name>.*<\/domain>.*/\1/p')"
|
||||
_domain_extension="$(echo "$item" | sed -n 's/.*<domain>.*<extension>\(.*\)<\/extension>.*<\/domain>.*/\1/p')"
|
||||
_debug _domain_name "$_domain_name"
|
||||
_debug _domain_extension "$_domain_extension"
|
||||
if [ "$_domain_name.$_domain_extension" = "$h" ]; then
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
|
||||
total="$(echo "$response" | _egrep_o '<total>.*?<\/total>' | sed -n 's/.*<total>\(.*\)<\/total>.*/\1/p')"
|
||||
|
||||
_debug total "$total"
|
||||
|
||||
if [ "$results_retrieved" -eq "$total" ]; then
|
||||
results_retrieved=0
|
||||
i="$(_math "$i" + 1)"
|
||||
fi
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
_openprovider_request() {
|
||||
request_xml=$1
|
||||
|
||||
xml_prefix='<?xml version="1.0" encoding="UTF-8"?>'
|
||||
xml_content=$(printf '<openXML><credentials><username>%s</username><hash>%s</hash></credentials>%s</openXML>' "$OPENPROVIDER_USER" "$OPENPROVIDER_PASSWORDHASH" "$request_xml")
|
||||
response="$(_post "$(echo "$xml_prefix$xml_content" | tr -d '\n')" "$OPENPROVIDER_API" "" "POST" "application/xml")"
|
||||
_debug response "$response"
|
||||
if ! _contains "$response" "<openXML><reply><code>0</code>.*</reply></openXML>"; then
|
||||
_err "API request failed."
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
@ -0,0 +1,164 @@
|
||||
#!/usr/bin/env sh
|
||||
|
||||
#
|
||||
# ULTRA_USR="your_user_goes_here"
|
||||
#
|
||||
# ULTRA_PWD="some_password_goes_here"
|
||||
|
||||
ULTRA_API="https://restapi.ultradns.com/v2/"
|
||||
|
||||
#Usage: add _acme-challenge.www.domain.com "some_long_string_of_characters_go_here_from_lets_encrypt"
|
||||
dns_ultra_add() {
|
||||
fulldomain=$1
|
||||
txtvalue=$2
|
||||
export txtvalue
|
||||
ULTRA_USR="${ULTRA_USR:-$(_readaccountconf_mutable ULTRA_USR)}"
|
||||
ULTRA_PWD="${ULTRA_PWD:-$(_readaccountconf_mutable ULTRA_PWD)}"
|
||||
if [ -z "$ULTRA_USR" ] || [ -z "$ULTRA_PWD" ]; then
|
||||
ULTRA_USR=""
|
||||
ULTRA_PWD=""
|
||||
_err "You didn't specify an UltraDNS username and password yet"
|
||||
return 1
|
||||
fi
|
||||
# save the username and password to the account conf file.
|
||||
_saveaccountconf_mutable ULTRA_USR "$ULTRA_USR"
|
||||
_saveaccountconf_mutable ULTRA_PWD "$ULTRA_PWD"
|
||||
_debug "First detect the root zone"
|
||||
if ! _get_root "$fulldomain"; then
|
||||
_err "invalid domain"
|
||||
return 1
|
||||
fi
|
||||
_debug _domain_id "${_domain_id}"
|
||||
_debug _sub_domain "${_sub_domain}"
|
||||
_debug _domain "${_domain}"
|
||||
_debug "Getting txt records"
|
||||
_ultra_rest GET "zones/${_domain_id}/rrsets/TXT?q=value:${fulldomain}"
|
||||
if printf "%s" "$response" | grep \"totalCount\" >/dev/null; then
|
||||
_err "Error, it would appear that this record already exists. Please review existing TXT records for this domain."
|
||||
return 1
|
||||
fi
|
||||
|
||||
_info "Adding record"
|
||||
if _ultra_rest POST "zones/$_domain_id/rrsets/TXT/${_sub_domain}" '{"ttl":300,"rdata":["'"${txtvalue}"'"]}'; then
|
||||
if _contains "$response" "Successful"; then
|
||||
_info "Added, OK"
|
||||
return 0
|
||||
elif _contains "$response" "Resource Record of type 16 with these attributes already exists"; then
|
||||
_info "Already exists, OK"
|
||||
return 0
|
||||
else
|
||||
_err "Add txt record error."
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
_err "Add txt record error."
|
||||
|
||||
}
|
||||
|
||||
dns_ultra_rm() {
|
||||
fulldomain=$1
|
||||
txtvalue=$2
|
||||
export txtvalue
|
||||
ULTRA_USR="${ULTRA_USR:-$(_readaccountconf_mutable ULTRA_USR)}"
|
||||
ULTRA_PWD="${ULTRA_PWD:-$(_readaccountconf_mutable ULTRA_PWD)}"
|
||||
if [ -z "$ULTRA_USR" ] || [ -z "$ULTRA_PWD" ]; then
|
||||
ULTRA_USR=""
|
||||
ULTRA_PWD=""
|
||||
_err "You didn't specify an UltraDNS username and password yet"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_debug "First detect the root zone"
|
||||
if ! _get_root "$fulldomain"; then
|
||||
_err "invalid domain"
|
||||
return 1
|
||||
fi
|
||||
_debug _domain_id "${_domain_id}"
|
||||
_debug _sub_domain "${_sub_domain}"
|
||||
_debug _domain "${domain}"
|
||||
|
||||
_debug "Getting TXT records"
|
||||
_ultra_rest GET "zones/${_domain_id}/rrsets?q=kind:RECORDS+owner:${_sub_domain}"
|
||||
|
||||
if ! printf "%s" "$response" | grep \"resultInfo\" >/dev/null; then
|
||||
_err "There was an error in obtaining the resource records for ${_domain_id}"
|
||||
return 1
|
||||
fi
|
||||
|
||||
count=$(echo "$response" | _egrep_o "\"returnedCount\":[^,]*" | cut -d: -f2 | cut -d'}' -f1)
|
||||
_debug count "${count}"
|
||||
if [ "${count}" = "" ]; then
|
||||
_info "Text record is not present, will not delete anything."
|
||||
else
|
||||
if ! _ultra_rest DELETE "zones/$_domain_id/rrsets/TXT/${_sub_domain}" '{"ttl":300,"rdata":["'"${txtvalue}"'"]}'; then
|
||||
_err "Deleting the record did not succeed, please verify/check."
|
||||
return 1
|
||||
fi
|
||||
_contains "$response" ""
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
#################### Private functions below ##################################
|
||||
#_acme-challenge.www.domain.com
|
||||
#returns
|
||||
# _sub_domain=_acme-challenge.www
|
||||
# _domain=domain.com
|
||||
# _domain_id=sdjkglgdfewsdfg
|
||||
_get_root() {
|
||||
domain=$1
|
||||
i=2
|
||||
p=1
|
||||
while true; do
|
||||
h=$(printf "%s" "$domain" | cut -d . -f $i-100)
|
||||
_debug h "$h"
|
||||
_debug response "$response"
|
||||
if [ -z "$h" ]; then
|
||||
#not valid
|
||||
return 1
|
||||
fi
|
||||
if ! _ultra_rest GET "zones"; then
|
||||
return 1
|
||||
fi
|
||||
if _contains "${response}" "${h}." >/dev/null; then
|
||||
_domain_id=$(echo "$response" | _egrep_o "${h}")
|
||||
if [ "$_domain_id" ]; then
|
||||
_sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
|
||||
_domain="${h}"
|
||||
_debug sub_domain "${_sub_domain}"
|
||||
_debug domain "${_domain}"
|
||||
return 0
|
||||
fi
|
||||
return 1
|
||||
fi
|
||||
p=$i
|
||||
i=$(_math "$i" + 1)
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
_ultra_rest() {
|
||||
m=$1
|
||||
ep="$2"
|
||||
data="$3"
|
||||
_debug "$ep"
|
||||
_debug TOKEN "${AUTH_TOKEN}"
|
||||
|
||||
_ultra_login
|
||||
export _H1="Content-Type: application/json"
|
||||
export _H2="Authorization: Bearer ${AUTH_TOKEN}"
|
||||
|
||||
if [ "$m" != "GET" ]; then
|
||||
_debug data "${data}"
|
||||
response="$(_post "${data}" "${ULTRA_API}"/"${ep}" "" "${m}")"
|
||||
else
|
||||
response="$(_get "$ULTRA_API/$ep")"
|
||||
fi
|
||||
}
|
||||
|
||||
_ultra_login() {
|
||||
export _H1=""
|
||||
export _H2=""
|
||||
AUTH_TOKEN=$(_post "grant_type=password&username=${ULTRA_USR}&password=${ULTRA_PWD}" "${ULTRA_API}authorization/token" | cut -d, -f3 | cut -d\" -f4)
|
||||
export AUTH_TOKEN
|
||||
}
|
||||
@ -0,0 +1,149 @@
|
||||
#!/usr/bin/env sh
|
||||
|
||||
# Zone.ee dns API
|
||||
# https://help.zone.eu/kb/zoneid-api-v2/
|
||||
# required ZONE_Username and ZONE_Key
|
||||
|
||||
ZONE_Api="https://api.zone.eu/v2"
|
||||
######## Public functions #####################
|
||||
|
||||
#Usage: dns_zone_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
|
||||
dns_zone_add() {
|
||||
fulldomain=$1
|
||||
txtvalue=$2
|
||||
_info "Using zone.ee dns api"
|
||||
_debug fulldomain "$fulldomain"
|
||||
_debug txtvalue "$txtvalue"
|
||||
ZONE_Username="${ZONE_Username:-$(_readaccountconf_mutable ZONE_Username)}"
|
||||
ZONE_Key="${ZONE_Key:-$(_readaccountconf_mutable ZONE_Key)}"
|
||||
if [ -z "$ZONE_Username" ] || [ -z "$ZONE_Key" ]; then
|
||||
ZONE_Username=""
|
||||
ZONE_Key=""
|
||||
_err "Zone api key and username must be present."
|
||||
return 1
|
||||
fi
|
||||
_saveaccountconf_mutable ZONE_Username "$ZONE_Username"
|
||||
_saveaccountconf_mutable ZONE_Key "$ZONE_Key"
|
||||
_debug "First detect the root zone"
|
||||
if ! _get_root "$fulldomain"; then
|
||||
_err "invalid domain"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_debug "Adding txt record"
|
||||
|
||||
if _zone_rest POST "dns/${_domain}/txt" "{\"name\": \"$fulldomain\", \"destination\": \"$txtvalue\"}"; then
|
||||
if printf -- "%s" "$response" | grep "$fulldomain" >/dev/null; then
|
||||
_info "Added, OK"
|
||||
return 0
|
||||
else
|
||||
_err "Adding txt record error."
|
||||
return 1
|
||||
fi
|
||||
else
|
||||
_err "Adding txt record error."
|
||||
fi
|
||||
}
|
||||
|
||||
#Usage: fulldomain txtvalue
|
||||
#Remove the txt record after validation.
|
||||
dns_zone_rm() {
|
||||
fulldomain=$1
|
||||
txtvalue=$2
|
||||
_info "Using zone.ee dns api"
|
||||
_debug fulldomain "$fulldomain"
|
||||
_debug txtvalue "$txtvalue"
|
||||
ZONE_Username="${ZONE_Username:-$(_readaccountconf_mutable ZONE_Username)}"
|
||||
ZONE_Key="${ZONE_Key:-$(_readaccountconf_mutable ZONE_Key)}"
|
||||
if [ -z "$ZONE_Username" ] || [ -z "$ZONE_Key" ]; then
|
||||
ZONE_Username=""
|
||||
ZONE_Key=""
|
||||
_err "Zone api key and username must be present."
|
||||
return 1
|
||||
fi
|
||||
_saveaccountconf_mutable ZONE_Username "$ZONE_Username"
|
||||
_saveaccountconf_mutable ZONE_Key "$ZONE_Key"
|
||||
_debug "First detect the root zone"
|
||||
if ! _get_root "$fulldomain"; then
|
||||
_err "invalid domain"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_debug "Getting txt records"
|
||||
_debug _domain "$_domain"
|
||||
|
||||
_zone_rest GET "dns/${_domain}/txt"
|
||||
|
||||
if printf "%s" "$response" | grep \"error\" >/dev/null; then
|
||||
_err "Error"
|
||||
return 1
|
||||
fi
|
||||
|
||||
count=$(printf "%s\n" "$response" | _egrep_o "\"name\":\"$fulldomain\"" | wc -l)
|
||||
_debug count "$count"
|
||||
if [ "$count" = "0" ]; then
|
||||
_info "Nothing to remove."
|
||||
else
|
||||
record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":\"[^\"]*\",\"resource_url\":\"[^\"]*\",\"name\":\"$fulldomain\"," | cut -d : -f2 | cut -d , -f1 | tr -d \" | _head_n 1)
|
||||
if [ -z "$record_id" ]; then
|
||||
_err "No id found to remove."
|
||||
return 1
|
||||
fi
|
||||
if ! _zone_rest DELETE "dns/${_domain}/txt/$record_id"; then
|
||||
_err "Record deleting error."
|
||||
return 1
|
||||
fi
|
||||
_info "Record deleted"
|
||||
return 0
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
#################### Private functions below ##################################
|
||||
|
||||
_zone_rest() {
|
||||
m=$1
|
||||
ep="$2"
|
||||
data="$3"
|
||||
_debug "$ep"
|
||||
|
||||
realm="$(printf "%s" "$ZONE_Username:$ZONE_Key" | _base64)"
|
||||
|
||||
export _H1="Authorization: Basic $realm"
|
||||
export _H2="Content-Type: application/json"
|
||||
|
||||
if [ "$m" != "GET" ]; then
|
||||
_debug data "$data"
|
||||
response="$(_post "$data" "$ZONE_Api/$ep" "" "$m")"
|
||||
else
|
||||
response="$(_get "$ZONE_Api/$ep")"
|
||||
fi
|
||||
|
||||
if [ "$?" != "0" ]; then
|
||||
_err "error $ep"
|
||||
return 1
|
||||
fi
|
||||
_debug2 response "$response"
|
||||
return 0
|
||||
}
|
||||
|
||||
_get_root() {
|
||||
domain=$1
|
||||
i=2
|
||||
while true; do
|
||||
h=$(printf "%s" "$domain" | cut -d . -f $i-100)
|
||||
_debug h "$h"
|
||||
if [ -z "$h" ]; then
|
||||
return 1
|
||||
fi
|
||||
if ! _zone_rest GET "dns/$h/a"; then
|
||||
return 1
|
||||
fi
|
||||
if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
|
||||
_domain=$h
|
||||
return 0
|
||||
fi
|
||||
i=$(_math "$i" + 1)
|
||||
done
|
||||
return 0
|
||||
}
|
||||
Loading…
Reference in New Issue